A developer is building a mobile app that displays images stored in an S3 bucket. Users must be able to sign in with their Amazon account and with supported social media accounts. Which solution provides this authentication capability?

Amazon Cognito with web identity federation is the correct solution. It allows users to authenticate with well-known identity providers like Amazon, Google, and Facebook, which aligns with the requirement for signing in with Amazon and social media accounts. Cognito then provides temporary, limited-privilege AWS credentials that the mobile app can use to access S3 directly, without embedding long-lived credentials. SAML-based identity federation is typically used for enterprise applications and corporate directories, not for consumer-facing mobile apps with social logins. Embedding IAM access keys and secret keys in application code is a severe security risk and violates best practices. Calling AWS STS AssumeRole directly from the application code would require the application to manage its own authentication and credential exchange with STS, which is complex and less secure than using Cognito, which handles this process seamlessly.